A malicious extension for Google Chrome has been developed that experts warn can steal passwords in plaintext format.
Researchers from the University of Wisconsin-Madison recently uploaded a proof-of-concept to the Chrome Web Store to show users’ passwords can be extracted from a website’s source code.
In examining the text input fields of web browsers, the researchers found that Chrome has greater privileges than it should due to the coarse-grained permission model it uses. This allows extensions to retrieve the data from these fields.
Plain text stealing
To compound the problem, the researchers found that popular websites with visitors in the millions – including Gmail, Facebook, and Amazon, to name a few – store user passwords in plain text within the HTML code of their pages, making it possible for extensions to see what they are.
The researchers said that extensions are routinely given unrestricted access to websites’ DOM trees, which allows them to ascertain the content of text input fields and a page’s source code, with no buffer in place between the extension and the website code to prevent this.
The researcher’s extension can also manipulate the DOM API to extract text from an input field on a website as the victim is typing, which bypasses any security attempts from the website to obfuscate sensitive text like passwords.
Even though Google recently launched the Manifest V3 protocol for Chrome extensions, which is supposed to limit abuse to APIs, prevent arbitrary code execution and stop extensions from using remote code to avoid detection, the researchers claim that it does not offer protection between extensions and web pages, so content scripts are still vulnerable.
In order to see if the extension would get through Google’s review process, the researchers decided to upload their extension to the Chrome Web Store under the guide of a ChatGPT assistant.
Since it does not contain malicious code or retrieve code from external sources, it is compliant with Manifest V3. Google therefore allowed it to be uploaded to its store. The researchers did not actually steal any user data, though. They also left the extension as unpublished and removed it from the store soon after it was approved.
The researchers claim that over a thousand of the world’s most popular websites store user passwords in plain text within their HTML source code, and a further 7,300 sites are vulnerable to DOM API access, allowing for direct extraction of user inputs.
They also said that roughly 17,300 (12.5%) Chrome extensions can extract this kind of sensitive information legitimately via permissions granted to them by Google. Many have millions of installs, and include popular ad blockers and shopping apps.
